What is zero trust, and how does it change network design?
Show the answer
Say this first
Zero trust drops the idea that being on the internal network makes you trusted. Every request to a resource is authenticated and authorized on its own, using user identity, device health and context, with least privilege, and the design assumes an attacker is already inside. In the network that means identity-based access (802.1X and NAC), microsegmentation so workloads reach only what they need, ZTNA brokers that give users access to one application instead of a full tunnel onto the LAN, encryption everywhere, and continuous monitoring. NIST SP 800-207 is the usual reference.
Go deeper
The parts, in NIST terms
- Policy engine: decides whether a request is allowed, using identity, device posture, threat data.
- Policy administrator: sets up or tears down the session based on that decision.
- Policy enforcement point: the gateway, proxy, agent or firewall that lets the traffic through.
VPN versus ZTNA
| Classic remote access VPN | ZTNA | |
|---|---|---|
| What the user gets | an IP on the network, many subnets reachable | access to named applications only |
| Exposure | VPN gateway listens on the internet | apps are hidden; connectors dial out to a broker |
| Decision | once at login | every session, with device posture |
Where to start
- Inventory users, devices, applications and flows.
- Strong identity: SSO with MFA everywhere.
- Device trust: managed devices, posture checks.
- Segment the crown jewels first, with group-based policy (TrustSec SGTs, cloud security groups, host firewalls) rather than IP-only rules.
- Replace broad VPN access for contractors and third parties with per-application access.
- Log every decision and watch for anomalies.
They will ask next
Is zero trust a product you can buy?
No. It is an architecture. Vendors sell parts of it, such as ZTNA brokers, NAC and segmentation tools, but the policy model and the inventory are work you have to do.
Does zero trust mean no more firewalls?
No. Firewalls become enforcement points among many, closer to the workloads. The change is that their rules are based on identity and context, not on "inside is trusted".
Traps
- Saying zero trust means "trust no one, block everything". It means verify explicitly, then allow the minimum.